Nginx – How to use abstract names of unix domain sockets with fastcgi in nginx

chrootfastcginginxperlsocket

I tried some perl examples of unix domain sockets using abstract names:
Created a socket starting with a null character:

my $socket_path = "\0wibble";

using netstat -nlp I can see the socket:

unix  2      [ ACC ]     STREAM     LISTENING     309510   3448/perl            @wibble

In examples all is working, but…
I want to use fastCGI in nginx with unix domain sockets using abstract names:

So in nginx.conf:

Using       fastcgi_pass  "/tmp/wibble"; #is Ok
But using       fastcgi_pass  "unix:Any_name"; #is not Ok!!

I tried \0wibble \zwibble \x{0}wibble and it didnt work!

At fastcgi-wrapper.pl I tried:

Using        $socket = FCGI::OpenSocket( "/tmp/wibble", 10 ); #is Ok
But using       fastcgi_pass  "unix:Any_name"; #is not Ok!!

I tried \0wibble \zwibble \x{0}wibble and it didnt work!

BTW: I want to use chroot on nginx and chroot in perl, so I cannot use a filesystem socket, as it will be a path out of jail and a security flaw…

Best Answer

nginx doesn't support abstract sockets (as of today). However an unofficial patch exists which provides this support. Once applied, you can refer to an abstract socket as @wibble. If you use this patch, be sure to read the entire nginx forum thread regarding it, as it refers to various changes made to the patch.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Linux – How to debug troubles with unix domain sockets

It seems like you have problem with connect, not with send. Try to increase kernel receiver backlog:

echo "2000" > /proc/sys/net/core/netdev_max_backlog

sysctl –w sys.net.core.netdev_max_backlog=2000

Have you checked system logs (e.g. dmesg)?

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Linux – How to debug troubles with unix domain sockets

Related Topic